1. Field of the Invention
The present invention is related to anti-malware technology, and more particularly, to a method and system for a hardware accelerator for malware emulation.
2. Description of the Related Art
Over the past decade malware components and viruses have become more sophisticated. An ability to emulate an execution of a malware component on a computer system is critical in terms of providing security and maintaining integrity of a computer system data. Emulation is typically used for anti-virus and malware detection procedures. In order to analyze a behavior of malware components, such as viruses, and to collect statistics, a computer system is emulated and the viruses are run on the emulated computer system as shown in FIG. 1.
A computer system 100 has a host Operating System (OS) 110. The host OS 110 has an emulator 120 implemented within it. The emulator 120 is isolated from the host OS 110 and all processes launched within the emulator 120 do not have access to the host OS 110 file system. Thus, a potentially malicious process executed within the emulator 120 cannot cause any harm to the host OS 110 and the computer system 100.
The emulator 120 emulates an operating system (which may be the same as the host OS 110, or may be a different OS). It has an emulated CPU 140 and an emulated operating memory 150. When an executable component is emulated, a process 130 is launched within the emulator 120. The process 130 uses computation resources of the emulator 120 for execution of its instructions. Since the CPU 140 is emulated, the process executes much slower than if it were executed on the real CPU of the computer system 100. Modern viruses can often involve a large number of executed instructions, and, therefore, speed of execution of emulated code becomes important.
Furthermore, many malware components are programmed in such a way, that when executed on a computer system, they first run a large number of processes that are non-malicious by nature. The sole purpose of these processes is to tie down the emulator and use up its resources to the point where it cannot effectively emulate the malicious processes that follow.
These “useless” processes are often referred to as “dummy processes” or “dummy loops.” The dummy loops can perform millions of senseless operations that slow down the emulation process from a several seconds up to several minutes, which is a significant amount of time in terms of malware detection. Also, some processes such as unpacking can also take a significant amount of time. Also, some processes inherently involve a large number of instructions. For example, the calculation of the value of pi to a large precision is calculation-intensive (and may be entirely irrelevant to the purpose of the program, but solely intended to load the CPU and therefore “trick” the emulator). The remainder of this description primarily mentions dummy loops, however, it is understood that the concepts described herein are applicable to other calculation-intensive processes, such as unpacking, decryption, etc. For effective malware detection, the emulation should take not much longer than a few seconds or even one or two seconds. Thus, the emulator will emulate only the dummy loops (or only some of them) and will finish its work, since no malicious actions are detected over this period of time.
Thus, the emulation of the malware component stops before it gets to the “real” malicious code. This presents a serious problem for malware detection, as some malware components will be undetected due to the dummy loops contained in them. Conventional emulators lack sufficient processing speed and need to work faster in order to detect malware containing dummy loops.
Accordingly, a system and method for accelerating the malware emulators is desired.